#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

struct event {
    char comm[128];
};

struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 256 * 1024);
} ringbuf SEC(".maps");

SEC("tp/syscalls/sys_enter_execve")
int bpf_prog(void *ctx)
{
    struct event *e = bpf_ringbuf_reserve(&ringbuf, sizeof(struct event), 0);
    if (!e)
        return 0;

    bpf_get_current_comm(&e->comm, sizeof(e->comm));

    bpf_ringbuf_submit(e, 0);

    return 0;
}

char _license[] SEC("license") = "GPL";
